chromium/third_party/blink/web_tests/fast/parser/math-options-crash.html

<script src="../../resources/dump-as-markup.js"></script>
This test passes if it doesn't crash.
<math><option><option></html><option></option>